CN105450598A

CN105450598A - Information identification method, information identification equipment and user terminal

Info

Publication number: CN105450598A
Application number: CN201410401525.6A
Authority: CN
Inventors: 程明强; 耿志贤; 孙大勇; 高宝贵; 张佳益
Original assignee: COEUSYS Inc
Current assignee: Silver Li'an financial information services (Beijing) Co., Ltd.
Priority date: 2014-08-14
Filing date: 2014-08-14
Publication date: 2016-03-30

Abstract

An embodiment of the invention provides an information identification method, information identification equipment and user terminal. The method includes the steps of: obtaining a first behavior parameter of a user terminal, the first behavior parameter including position information of the user terminal and time information corresponding to the position information, and building a behavior analysis model of the user terminal according to the first behavior parameter of the user terminal; obtaining a second behavior parameter of the user terminal, the second behavior parameter including position information when the user terminal executes a current on-line service and time information corresponding to the position information, and determining whether to allow the user terminal to execute the current on-line service according to the second behavior parameter of the user terminal and the behavior analysis model of the user terminal. The information identification method, information identification equipment and user terminal provided by the embodiment of the invention can effectively improve security of executing the on-line service.

Description

Information identifying method, information identification equipment and user terminal

Technical field

The present invention relates to mobile Internet field, particularly relate to a kind of information identifying method, information identification equipment and user terminal.

Background technology

Along with developing rapidly of mobile Internet, as current 3G, 4G network has covered most of region, the popularization degree of intelligent terminal is also more and more higher, and increasing people uses intelligent terminal to process daily Mobile solution business, as office, shopping, remittance, pays public works expenses etc.Wherein with the fastest developing speed is exactly the on-line payment business that shopping at network brings, as micro-letter payment, mobile phone Taobao etc.

Intelligent terminal is used to carry out Mobile solution, as for on-line payment business, although convenient and swift, but fail safe receives much concern always, it is not only the fail safe that user pays close attention to mobile payment, and operator, bank, businessman etc. are concerned about the safety issue of on-line payment all very much, after intelligent terminal as being provided with payment software is stolen by other people, although not by the manipulation of original subscriber, but still can carry out on-line payment business, this brings huge potential safety hazard to on-line payment business, and the fail safe therefore improving on-line payment is urgent problem.At present in the fail safe strengthening mobile payment, mainly contain following technological means:

1, the transaction upper limit is set, as part financial institution can give some options of user terminal, user terminal can select day the highest turnover or single the highest online turnover online according to prompting, the amount of money of mobile payment is controlled within a rational scope, even if meet accident, also can the damage control within limits, user be avoided to suffer larger loss, but the drawback of this mode is the inconvenience caused to user in use, cannot meet the demand of user;

2, dynamic verification code or password, part financial institution, by sending transaction dynamic verification code to user terminal, adds the fail safe of transaction, improves coefficient of safety.But the direct result done like this is exactly every transaction all needs client's requests verification code, and input validation code could be concluded the business, and the time of input validation code is also restricted, expiredly will cancel, the triviality of adding users operation, simultaneously user mobile phone must keep start and can not arrearage;

3, wholesale spending amount is reminded, part financial institution all can carry out inform by short message every of consumer consumption, tell dealing money and the loco of consumer, transaction is there is extremely if had, consumer understands initiative alarming or carries out other operations, but this set is after brush is stolen in generation, still cannot avoids stealing brush, the fail safe of mobile payment cannot be increased;

4, pay with trading password, although Current Password is fairly perfect, as dynamic encryption technology, multi-party computations method, all compares and is applicable to mobile payment industry.But these methods all need a large amount of calculating, and need the troublesome operation constantly repeating input password or identifying code from user perspective, affect Consumer's Experience.

5, improve the fail safe of SIM card, current SIM card is easily replicated or falsely claims as one's own, the case that false identity card often can be used to report the loss SIM card cause user to lose.To the means that this operator may adopt the technological means such as real-name authentication and finger print identifying to combine from now on, financial level security chip and encryption software are installed on mobile terminals simultaneously to prevent SIM to be replicated or to falsely claim as one's own, but these technology innovation more complicated, increase cost.

6, arrange special security model, on the technological layer of secure payment, effective security model also can well protect the safety of privacy of user and transaction.As to central controlled network environment, adopt business-class security model, access control based roles (RBAC), is divided into RDID label, read write line, information processing system by RDID; Data are placed on in information processing system in RDID label respectively, and ability password to decipher after the two merging, when label changes, encryption and decryption password also changes thereupon.But this safe answering technology, it calculates, storage overhead is large, and real-time is not strong, is not suitable for mobile security field.

7, other security means, as " the adaptive security configuration " that may release at present, it can make intelligent terminal automatically forbid based on self geographic location or allow security protocol, such as an intelligent terminal passes through location finding oneself in user's family, it just allows user to pass through the unlock password of 4 bit digital, but it finds that it is not in user family, and so it just requires to use unlocked by fingerprint, so perhaps effectively can strengthen the fail safe of data in mobile phone.

To sum up, perfect not enough to the safety precautions of user terminal in Mobile solution in prior art, otherwise safety guarantee effect is poor, otherwise operation is too complicated, affects Consumer's Experience.

Summary of the invention

Embodiments provide a kind of information identifying method, information identification equipment and user terminal, can carry out providing safety guarantee at line service for user terminal.

First aspect, provides a kind of information identifying method, comprising:

Obtain the first behavioral parameters of user terminal, described first behavioral parameters comprises the positional information of user terminal and temporal information corresponding to described positional information, builds the Analysis model of network behaviors of described user terminal according to the first behavioral parameters of described user terminal;

Obtain the second behavioral parameters of described user terminal, described second behavioral parameters comprises described user terminal and performs the current positional information when line service and temporal information corresponding to described positional information, according to the Analysis model of network behaviors of described user terminal second behavioral parameters and described user terminal, determine whether to allow described user terminal to perform current at line service.

In conjunction with first aspect, in the first possible implementation of first aspect, described the first behavioral parameters according to user terminal also comprises before building the Analysis model of network behaviors of described user terminal:

For described user terminal arranges different scenes, concrete:

Be between multiple lane place by the Region dividing residing for described user terminal, a scene of user terminal will be set between each lane place; Or

Be between multiple lane place by the Region dividing residing for described user terminal, the set of time that will occur in conjunction with described user terminal between each lane place is a scene of user terminal;

Be between multiple lane place by the Region dividing residing for described user terminal, a scene of user terminal will be set between the described user terminal lane place that occurrence number exceedes predetermined threshold in the given time; Or

A scene of described user terminal was set between the lane place that described user terminal was occurred.

In conjunction with the first possible implementation of first aspect, in the implementation that the second of first aspect is possible, the Analysis model of network behaviors that described the first behavioral parameters according to user terminal builds described user terminal comprises:

Add up the number of times that described user terminal occurs in each scene, generate the scene factor corresponding to each scene according to the number of times that described user terminal occurs in each scene;

Build the mapping relations of described user terminal and the described scene factor.

In conjunction with the first implementation possible with the second of first aspect, in the third possible implementation of first aspect, the described Analysis model of network behaviors according to described user terminal second behavioral parameters and described user terminal, determine whether to allow described user terminal to perform current at line service, comprising:

When determining that the scene factor corresponding to the second behavioral parameters of described user terminal is greater than the scene factor threshold of described setting, described user terminal is allowed to perform current at line service.

In conjunction with the first implementation possible with the second of first aspect, in the 4th kind of possible implementation of first aspect, described method also comprises:

The behavior of described user terminal is analyzed, according to the behavioural analysis result of described user terminal, Clustering is carried out to described user terminal.

In conjunction with first aspect the first, the second and the 4th kind of possible implementation, in the 5th kind of possible implementation of first aspect, the method for described user terminal being carried out to cluster use comprises expectation maximization algorithm, kmeans, Agglomerative Hierarchical Clustering or dbscan; The measuring similarity used in clustering algorithm comprises Cosin method, Euclidean distance, likeness coefficient or coefficient correlation, carries out the method that initialization uses comprise singular value decomposition method, random selected initial value method or specify initial value method described clustering algorithm.

In conjunction with first aspect the first, the second and the 4th kind of possible implementation, or in conjunction with first aspect the first, the second, the 4th kind and the 5th kind of possible implementation, in the 6th kind of possible implementation of first aspect, the described Analysis model of network behaviors according to described user terminal second behavioral parameters and described user terminal, determine whether to allow described user terminal to perform current at line service, comprising:

Determine to perform the current group belonging to the user terminal of line service;

Determine whether to allow described user terminal to perform according to the safety regulation of described group current at line service.

In conjunction with first aspect the first, the second, the 4th kind, the 5th kind and the 6th kind of possible implementation, or in conjunction with in conjunction with first aspect the first, the second, the 4th kind and the 6th kind of possible implementation, in the 7th kind of possible implementation of first aspect, determine whether to allow described user terminal to perform according to the safety regulation of described group current at line service, comprising:

Determine whether to allow described user terminal to perform according to the safety regulation of user terminal or Analysis model of network behaviors that are positioned at described group center current at line service.

In conjunction with the first implementation possible with the second of first aspect, in the 8th kind of possible implementation of first aspect, described method also comprises:

For the first behavior optimum configurations weight of described user terminal, described first behavioral parameters also comprises at least one that perform in the habit of transaction of the transaction record of the Secure Transaction rule of the previous conviction of user described in the type of line service, trading object, transaction network address, user terminal, user terminal, user terminal, user terminal.

In conjunction with first aspect the first, the second and the 8th kind of possible implementation, in the 9th kind of possible implementation of first aspect, the described Analysis model of network behaviors according to described user terminal second behavioral parameters and described user terminal, determine whether to allow described user terminal to perform current at line service, comprising:

The weight of second behavioral parameters of described user terminal according to described first behavioral parameters is weighted, if the numerical value after weighting exceedes the threshold value of setting, then allows described user terminal to perform current at line service.

Second aspect, provides a kind of information identification equipment, comprising:

Receiving element, for obtaining the first behavioral parameters of user terminal, described first behavioral parameters comprises the positional information of user terminal and temporal information corresponding to described positional information; Receive the second behavioral parameters of described user terminal, described second behavioral parameters comprises described user terminal and performs the current positional information when line service and temporal information corresponding to described positional information;

Dispensing unit, the first behavioral parameters for the described user terminal obtained according to described receiving element builds the Analysis model of network behaviors of described user terminal;

Determining unit, for the Analysis model of network behaviors according to described user terminal second behavioral parameters and described user terminal, determines whether to allow described user terminal to perform current at line service.

In conjunction with second aspect, in the first possible implementation of second aspect, described dispensing unit, also for arranging different scenes for described user terminal, concrete:

Be between multiple lane place by the Region dividing residing for described user terminal, a scene of described user terminal will be set between each lane place; Or

Be between multiple lane place by the Region dividing residing for described user terminal, the set of time that will occur in conjunction with described user terminal between each lane place is a scene of user terminal; Or

Be between multiple lane place by the Region dividing residing for described user terminal, a scene of described user terminal will be set between the described user terminal lane place that occurrence number exceedes predetermined threshold in the given time; Or

In conjunction with the first possible implementation of second aspect, in the implementation that the second of second aspect is possible, the number of times that described dispensing unit occurs in each scene specifically for adding up described user terminal, generate the scene factor corresponding to each scene according to the number of times that described user terminal occurs in each scene, build the mapping relations of described user terminal and the described scene factor.

In conjunction with the first implementation possible with the second of second aspect, in the third possible implementation of second aspect, described determining unit specifically for determine described user terminal the second behavioral parameters corresponding to the scene factor be greater than the scene factor threshold of described setting time, allow described user terminal to perform current at line service.

In conjunction with the first implementation possible with the second of second aspect, in the 4th kind of possible implementation of second aspect, described dispensing unit, also for analyzing the behavior of described user terminal, according to the behavioural analysis result of described user terminal, Clustering is carried out to described user terminal.

In conjunction with second aspect the first, the second and the 4th kind of possible implementation, in the 5th kind of possible implementation of second aspect, the method for described user terminal being carried out to cluster use comprises expectation maximization algorithm, kmeans, Agglomerative Hierarchical Clustering or dbscan; The measuring similarity used in clustering algorithm comprises Cosin method, Euclidean distance, likeness coefficient or coefficient correlation, carries out the method that initialization uses comprise singular value decomposition method, random selected initial value method or specify initial value method described clustering algorithm.

In conjunction with second aspect the first, the second and the 4th kind of possible implementation, or in conjunction with the first, the second, the 4th kind and the 5th kind of possible implementation, in the 6th kind of possible implementation of second aspect, described determining unit performs the current group belonging to the user terminal of line service specifically for determining, determines whether to allow described user terminal to perform current at line service according to the safety regulation of described group.

In conjunction with second aspect the first, the second, the 4th kind and the 6th kind of possible implementation, or in conjunction with the first, the second, the 4th kind, the 5th kind and the 6th kind of possible implementation, in the 7th kind of possible implementation of second aspect, described determining unit is current at line service specifically for determining whether to allow described user terminal to perform according to the safety regulation of user terminal or Analysis model of network behaviors that are positioned at described group center.

In conjunction with the first possible implementation of second aspect and the possible implementation of the second, in the 8th kind of possible implementation of second aspect, described dispensing unit is specifically for the first behavior optimum configurations weight for user terminal, and described first behavioral parameters also comprises at least one that perform in the habit of transaction of the transaction record of the Secure Transaction rule of the previous conviction of user described in the type of line service, trading object, transaction network address, user terminal, user terminal, user terminal, user terminal.

In conjunction with second aspect the first, the second and the 8th kind of possible implementation, in the 9th kind of possible implementation of second aspect, described determining unit is specifically for after being weighted the second behavioral parameters of described user terminal according to the weight of described first behavioral parameters, if the numerical value after weighting exceedes the threshold value of setting, then described user terminal is allowed to perform current at line service.

The third aspect, provides a kind of user terminal, comprising:

Acquiring unit, for obtaining the first behavioral parameters, described first behavioral parameters comprises the positional information of described user terminal and temporal information corresponding to described positional information; Obtain the second behavioral parameters, described second behavioral parameters comprises described user terminal and performs positional information when line service and temporal information corresponding to described positional information;

Antenna, server is sent to for the first behavioral parameters of being obtained by described acquiring unit and the second behavioral parameters, to make described first behavioral parameters for the Analysis model of network behaviors of user terminal described in described server construction, described second behavioral parameters is used for described server, and to determine whether to allow described user terminal to perform according to the Analysis model of network behaviors of described user terminal current at line service.

In conjunction with the third aspect, in the first possible implementation of the third aspect, described first behavioral parameters also comprises at least one in the habit of transaction of the previous conviction of user described in the type at line service of described user terminal, trading object, transaction network address, user terminal, the Secure Transaction rule of user terminal, the transaction record of user terminal, user terminal.

In conjunction with the third aspect or the first the possible implementation in conjunction with the third aspect, in the implementation that the second of the third aspect is possible, described antenna is also for receiving the instruction of described server, and indicate described acquiring unit to obtain the first behavioral parameters and second behavioral parameters of described user terminal according to described instruction, and described first behavioral parameters obtained by described acquiring unit and the second behavioral parameters send to described server.

The information identifying method that the embodiment of the present invention provides, information identification equipment and user terminal, have following beneficial effect:

1, the Analysis model of network behaviors of user terminal is based upon to carry out on the basis of statistical analysis to historical behavior parameter in the user terminal regular period, the not only positional information of counting user terminal, but also combine the time that user terminal appears at this position, the course of action simulating user terminal of maximum possible and habit of transaction, appropriator is difficult to imitate, and effectively ensure that the fail safe of transaction;

2, the Analysis model of network behaviors of user terminal not only comprises positional information and the temporal information of user terminal, and can also in conjunction with the information of the type of service of user terminal, habit of transaction and trading object, add the accuracy to user behavior analysis, improve the coefficient of safety of user terminal execution at line service;

3, when building Analysis model of network behaviors, both Analysis model of network behaviors can be set up for unique user terminal, Analysis model of network behaviors can also be set up for generic user terminal, both Analysis model of network behaviors can be set up for single parameter, Analysis model of network behaviors can also be set up in conjunction with many kinds of parameters, make the foundation of Analysis model of network behaviors more flexible, the service of differentiation can be realized;

4, the flexibility of rule operation, server can call different analytical models for different user terminals, makes to perform in the monitoring of line service more accurately flexible to user terminal;

5, server determination user terminal can not directly carry out when line service, both can select close user terminal current at line service, user terminal also can be allowed to carry out senior certification, meet the differentiated service of user terminal.

Accompanying drawing explanation

Fig. 1 is the first pass figure of the information identifying method that the embodiment of the present invention provides;

Fig. 2 is the second flow chart of the information identifying method that the embodiment of the present invention provides;

Fig. 3 is the 3rd flow chart of the information identifying method that the embodiment of the present invention provides;

Fig. 4 is the 4th flow chart of the information identifying method that the embodiment of the present invention provides;

Fig. 5 is the schematic diagram of the information identification equipment that the embodiment of the present invention provides;

Fig. 6 is the first schematic diagram of the user terminal that the embodiment of the present invention provides;

Fig. 7 is the second schematic diagram of the user terminal that the embodiment of the present invention provides.

Embodiment

The information identifying method, information identification equipment and the user terminal that there is provided the embodiment of the present invention below in conjunction with accompanying drawing are described in detail.

Embodiment one:

With reference to accompanying drawing 1, embodiments provide a kind of information identifying method, comprising:

S1, obtain the first behavioral parameters of user terminal, described first behavioral parameters comprises the positional information of user terminal and temporal information corresponding to described positional information;

In an embodiment of the invention, first behavioral parameters of user terminal can be the historical behavior parameter before this user terminal, server can continue the behavioral parameters obtaining (as a week, month, a season, a year etc.) in the user terminal fixed cycle, and carries out statistical analysis to the behavioral parameters got.In the present embodiment preferred scheme, first behavioral parameters comprises the positional information of user terminal and the temporal information corresponding to this positional information, as user terminal occurred in position 1, and the time occurred in position 1 general 9:00 ~ 12:00 in the morning all on weekdays, user terminal also occurred in position 2, and the time occurred in position 2 general 12:00 ~ 13:00 all on weekdays.In the present embodiment preferred scheme, the first behavioral parameters of user terminal also comprises the mark of user terminal, perform line service type, perform line service object, perform the information such as network address at line service.In the preferred scheme of the present embodiment another one, the mark of user terminal can be the IMSI of user terminal (InternationalMobileSubscriberIdentificationNumber, international mobile subscriber identity).

In the embodiment of the present invention preferred scheme, user terminal authorization server gathers the first behavioral parameters of user terminal, and the first behavioral parameters of the user terminal collected is sent to server, and server is preserved after carrying out statistical analysis.In the embodiment of the present invention preferred scheme, first behavioral parameters regularly can be sent to server by user terminal, or server sends request to user terminal, after user terminal receives the request of server, the first behavioral parameters of self is sent to server, concrete: as server sends Request message to user terminal, the first behavioral parameters of acquisition request user terminal; After user terminal receives the Request message of server transmission, send Answer response message to server, in described Answer response message, comprise the first behavioral parameters of described user terminal; Server receives Answer response message rear line terminal and returns ACK acknowledge message.

In embodiments of the present invention, user terminal can be the intelligent terminal such as smart mobile phone, panel computer, and also comprising other can be connected to the network and carry out the terminal equipment of Internet service.Server can be the equipment that computer, Server etc. have computing and memory function.

S2, build the Analysis model of network behaviors of described user terminal according to the first behavioral parameters of described user terminal;

In an embodiment of the invention, the region at user terminal place can be between multiple lane place according to certain regular partition by server, in a preferred scheme, the Region dividing at user terminal place can be cell one by one according to latitude and longitude information by server, if each cell is square the latter's rectangle, area is no more than 1 kilometer, and in the preferred scheme of another one, the area of cell is generally equal.In the preferred scheme of another one, each cell represents band of position letter, simultaneously an also corresponding scene.In the preferred scheme of another one, scene information comprises positional information and temporal information, as: 9:00 ~ 12:00 in the morning all on weekdays as the time that user terminal occurs in scene 1, user terminal appears at the time general 12:00 ~ 13:00 all on weekdays in scene 2, in the preferred scheme of another one, scene information can also comprise the online type of service that user terminal performs, as performed on-line payment business, in the preferred scheme of another one, scene information also comprises the object of user terminal execution at line service, as to as if bank, Taobao etc., in the preferred scheme of another one, scene information also comprises the website information of user terminal execution at line service, as www.boc.com etc.

In the another one preferred version of the embodiment of the present invention, except comprising number of times that user terminal occurs in above-mentioned scene and except the time in the scene information of user terminal, also comprise the preference etc. that user terminal performs online type of service in above-mentioned scene, remit money online, transfer accounts online as user terminal is in office scene, online shopping etc., and in body-building scene, generally do not perform any at line service etc.

In another one embodiment of the present invention, the scene information of user terminal can be specifically that the city at frequent for user terminal place is divided into multiple cell according to geographical location information, in the preferred scheme of another one, the region at current for user terminal place can also be divided into multiple cell according to geographical location information, in the preferred scheme of another one, the country at user terminal place can also be divided into multiple cell according to geographical location information, in the preferred scheme of another one, the whole earth can also be divided into multiple cell.In a preferred scheme, the area of the cell divided according to geographical location information can be equal, also can be unequal, in the preferred scheme of another one, also the place that user often occurs can be set as a cell, an i.e. scene, as in office, family, gymnasium, dining room, road on and off duty, the region such as out on tours.

In another one embodiment of the present invention, after server gets the positional information of user terminal, mate with the scene setting rule that server configures, determine the scene that the positional information of user terminal is corresponding, the times N that counting user terminal occurs in each scene.In another one scheme, server obtains the times N that counting user terminal occurs in different scene, then according to the times N generating scene factor (the UF-IUF factor), the number of times that the described scene factor and described user terminal occur in this scenario is directly proportional.

In another one embodiment of the present invention, the number of times that server statistics user terminal occurs in each band of position, the band of position number of times of appearance being exceeded certain threshold value is set to a scene.

In another one embodiment of the present invention, the computing formula of the scene factor (the UF-IUF factor) is:

(total degree that number of times/user that user terminal occurs in scene i occurs in all scenes) * (the user terminal number of the number/total of all user terminals occurred at scene i).

In another one embodiment of the present invention, server builds the Analysis model of network behaviors of described user terminal according to the first behavioral parameters of the user terminal obtained, and specifically comprises:

(1) corresponding relation of server construction user terminal and the scene factor, wherein, a database can be set up, preserve all scene factors of unique user terminal, also a database can be set up, preserve the mapping relations of all user terminals and the scene factor, carry out index with the mark of user terminal; The simultaneously threshold value of the server also scene set factor, when when user terminal performs at line service, the scene factor of place scene exceedes the threshold value of setting, user terminal is allowed to perform at line service, otherwise do not allow user terminal to perform at line service, or carry out high level certification, in the present embodiment, server is that user terminal arranges unified scene factor threshold, or is the scene factor threshold that each scene setting is different;

(2) scene information of server to each user terminal is analyzed, and then carries out cluster, and being gathered by user terminal similar for behavior is a class, and become a group, cluster can adopt singular value decomposition method, Cosin method and expectation-maximization algorithm etc.Identical or similar safety regulation can be set to the user terminal in same group, or to the user terminal in same group, all use the Analysis model of network behaviors of the user terminal being in this group center;

(3) server is the first behavior optimum configurations weight of user terminal, when the behavioral parameters of user terminal exceedes threshold value according to the numerical value after its Weight, user terminal is then allowed to perform at line service, otherwise do not allow user terminal to perform at line service, or carry out high level certification, in the present embodiment, server is the threshold value after user terminal arranges weighting.In another one scheme, server is the credit situation etc. that weight factor that user terminal is arranged comprises the first behavioral parameters, Secure Transaction rule, the scene factor, online type of service, trading object, transaction network address, the previous conviction of user terminal owning user, loyalty information, the situation of paying of common cost, the consumer record of user terminal and/or trading object.

S3, obtain the second behavioral parameters of described user terminal, described second behavioral parameters comprises described user terminal and performs the current positional information when line service and temporal information corresponding to described positional information;

In an embodiment of the invention, when user terminal performs at line service, current positional information and temporal information are reported server by user terminal, in the preferred scheme of another one, user terminal can also be performed and send to server together in the information such as type, object, website of line service.

S4, Analysis model of network behaviors according to described user terminal second behavioral parameters and described user terminal, determine whether to allow described user terminal to perform current at line service.

In another one embodiment of the present invention, server can be the second user terminal selecting Analysis model of network behaviors type at random, or the Analysis model of network behaviors type of the second behavioral parameters determination user terminal according to user terminal, determine whether to allow subscriber equipment to perform according to the Analysis model of network behaviors type selected and the second behavioral parameters current at line service, specifically comprise:

(1) according to the scene of the second behavioral parameters determination user terminal, and determine the corresponding scene factor according to the scene of user terminal, relatively whether this scene factor exceedes the threshold value of setting, if exceed threshold value, allows this user terminal to perform current at line service; Or,

(2) according to the group of the second behavioral parameters determination user terminal, as can according to the mark of user terminal, determine the group residing for this user terminal, according to the safety regulation of described group, determine whether to allow this user terminal to perform current at line service, or according to being in the Analysis model of network behaviors of user terminal of center in this group, determine whether to allow current user terminal to perform current at line service; Or,

(3) weight of this user terminal is searched according to the second behavioral parameters, weight factors all for this user terminal is weighted, and the threshold value of the result after weighting and setting is compared, if exceed threshold value, allow this user terminal to perform current at line service.

In another one embodiment of the present invention, set up the mapping relations of user terminal and the corresponding scene factor on the server, in a preferred scheme, can be set up a matrix on the server, the scene factor of user terminal in different scene is comprised in matrix, the row vector of matrix can represent the mark of user terminal, and column vector can represent scene identity, the intersection space of row vector and column vector is filled in the scene factor of this scene.In the preferred scheme of another one, comprising in the Analysis model of network behaviors of structure with user terminal identification is the scene database of index.In the preferred scheme of another one, can set up scene database for each user terminal, namely only preserve the scene factor of a user terminal under all scenes in this scene database, this scene database is designated index with this user terminal.In the preferred scheme of another one, the scene factor of multiple user terminal being kept in a scene database, can be a matrix sequence, take user ID as index.

In the preferred scheme of embodiment of the present invention another one, the Analysis model of network behaviors of structure has extensibility, after server extracts the new scene information of user terminal, upgrades the Analysis model of network behaviors built.In the preferred scheme of another one, server can also extract other scene information, upgrades or rebuilds Analysis model of network behaviors.

In another one embodiment of the present invention, Analysis model of network behaviors on server can be a dimension, also can be multiple dimension, concrete, a dimension can be comprise geographical location information and temporal information in scene, and multiple dimension is then to comprise geographical location information, temporal information, type of service, trading object and website information etc.In the present invention's preferred embodiment, other parameters of user terminal also can also be included in this model, thus the Analysis model of network behaviors of user terminal is built more detailed.

In an embodiment of the invention, each user terminal is regarded as a vector, therefore user terminal is being carried out in the process of cluster, comprise: use expectation maximization algorithm, kmeans (K mode clustering algorithm), the space of Agglomerative Hierarchical Clustering or density based and noise clustering algorithm (Density-BasedSpatialClusteringofApplicationswithNoise, etc. dbscan) method carries out cluster to user terminal, Cosin method is used in clustering algorithm, European cluster, likeness coefficient or coefficient correlation etc. represent the tolerance of two vectorial similarity degrees, in addition, clustering algorithm can also use singular value decomposition method, random selected initial value or formulate initial value method and carry out initialization to cluster centre before performing.The method of user terminal being carried out to cluster specifically comprises:

(1) vector Z 1, Z2 representated by k user terminal is set arbitrarily ... Zk is cluster centre point; Cluster centre point also can be selected at random, or is selected by the method for singular value decomposition.

(2) ask every other user terminal vector to the angle of cluster centre point, this user terminal is included in the class minimum with its angle;

(3) vector of all user terminals in k class is done on average, and with the vector after average as the new cluster centre of this group.

(4) repeatedly (2) (3) are carried out repeatedly, until the classification of all user terminals no longer changes, or till change is less than a given threshold value;

(5) after user terminal cluster completes, different safety regulations is arranged to each group, or the rule arranging each group is identical with the rule of the user terminal being in this group center.

In another one embodiment of the present invention, can be that a user terminal builds multiple Analysis model of network behaviors, described server can at random or be the corresponding Analysis model of network behaviors of described user terminal selecting according to the second behavioral parameters of user terminal.

It should be noted that, all threshold values in the embodiment of the present invention all can set according to concrete needs, and as in the lower region of fail safe, it is higher that threshold value can be arranged, and in the region that fail safe is relatively high, it is lower that threshold value can be arranged.Concrete arrange can the behavioral parameters of comprehensive reference user, the configuration, financial institution etc. of system requirement etc.

The recognition methods that the embodiment of the present invention provides, to realize the effective identification to the online transaction scene of user terminal based on positional information, when after the software that user terminal is installed with the function described by the embodiment of the present invention, server can collect position information of user's terminal when user terminal allows, scene residing for real-time analysis user terminal, when user terminal carries out at line service, server can scene information residing for user terminal and the safety regulation preset, judge that user terminal performs the fail safe at line service, if judge there is risk in suggestion, then force users is carried out senior certification or is stopped transaction.

Embodiment two:

With reference to accompanying drawing 2, the embodiment of the present invention additionally provides a kind of information identifying method, wherein:

200, the Analysis model of network behaviors of configure user terminal on the server, concrete sets up a matrix on the server, the scene factor of user terminal in different scene is comprised in matrix, the row vector of matrix can represent the mark of user terminal, column vector can represent scene identity, the intersection space of row vector and column vector is filled in the scene factor of this scene, concrete:

	Scene 1	Scene 2	Scene 3	……	Scene N
						User 1	0	1	3	……	0
User 2	1	0	2		1

……	……	……	……	……	……
						User n	0	1	0	……	1

In addition, configure on the server, the region that all scene factors are greater than 1 is safety zone, and user terminal can perform at line service under this scene, otherwise user terminal will start senior authentication procedure

201, user terminal 1 sends to server by performing in time of line service and positional information, concrete user terminal 1 has initiated an on-line payment business in Dian XX in the morning 10 mansion of Wednesday, and now residing positional information (longitude and latitude of XX mansion) and temporal information (point in the morning 10 Wednesday) are sent to server by user terminal;

202, server determines whether to allow to perform current at line service according to the time of user terminal 1 and positional information, concrete, in the scene list of server corresponding to the identification index of user terminal 1 to this user terminal 1, and determine that the scene corresponding to this user terminal 1 is scene 3 according to positional information and the temporal information that occurs in this position, find that its scene factor is 3 by inquiry, be greater than the scene factor threshold 1 of setting, therefore server sends message to user terminal 1, allows described user terminal 1 to perform on-line payment business;

203, after user terminal 1 receives the notice of server, directly on-line payment business is performed.

Embodiment three:

With reference to accompanying drawing 3, the embodiment of the present invention additionally provides a kind of information identifying method, wherein:

300, the Analysis model of network behaviors of configure user terminal on the server, concrete according to aforesaid clustering method, the user terminal that server is preserved is carried out Clustering, as being the first group by user terminal 2,3,4,5 cluster, is the second group by user terminal 6,7,8,9 cluster.It is all at line service that safety regulation corresponding to the first group is that the user terminal in this group can carry out, and safety regulation corresponding to the second group is that the user terminal in this group only can carry out on-line payment business;

301, when user terminal 7 initiates online money transfer transactions, server obtains the mark of this user terminal 7, determine that this user terminal 7 is positioned at the second group according to this mark, the safety regulation of the user terminal of this group to carry out on-line payment business, then do not allow described user terminal 7 to perform online money transfer transactions, and send a notification message to user terminal 7;

302, after user terminal 7 receives this notification message, current online money transfer transactions is stopped;

303, optional, if user terminal 7 is provided with high level of authentication program, then when server determination user terminal 7 can not perform online money transfer transactions, can select to start senior authentication procedure.Its middle-and-high-ranking certification, based on bio-identification, mainly comprises:

1) image (face) identifies

After user terminal selecting opens image recognition, system can require that user is by the human face image information of user terminal camera typing user, and is stored in database system.When the transaction that user terminal carries out exists risk, carry out certification, assert face by the camera motion capture be connected with electronic equipment, the face captured and the personnel stock face of typing are in advance compared identification simultaneously.

2) speech recognition

After the identification of user terminal selecting opening voice, system can point out user to read certain numeral or word content, the transfer voice of user is stored in system database to system background, when user terminal carries out the senior certification of transaction needs, carry out aspect ratio pair by user terminal microphone collection user's vocal print signal and database, identify user identity.

3) fingerprint recognition

After having user terminal to open fingerprint recognition, system can be pointed out and select which finger to carry out fingerprint typing (user can oneself select), and the finger print information preserved is stored in backstage, when carrying out senior certification, carried out the discriminating of personal identification by the details of more different fingerprint.

304, after certification is passed through, user terminal 7 performs current online money transfer transactions.

User terminal 7 can, according to arranging startup one or multiple high grade certification, if senior certification is passed through, then allow described user terminal 7 to perform current online money transfer transactions.

Embodiment four:

With reference to accompanying drawing 4, the embodiment of the present invention additionally provides a kind of information identifying method, arranges weight to the weight factor of user terminal, determines whether to allow to perform current business according to the result after Weight.Wherein arranging of weight can be human configuration herein, can with reference to the service needed of user terminal, and in addition, the setting of weight herein also can by the Algorithm for Training of machine learning out, namely use large data analysis to simulate the weight of each weight factor.Algorithm in the present embodiment comprises logistic regression, neural net, decision tree or maximum entropy scheduling algorithm, in this manner, do not need human configuration weight, but server directly generates the proportion of parameters.The information identifying method that the present embodiment provides specifically comprises:

400, the Analysis model of network behaviors of configure user terminal on the server, concrete, configures the weight of each weight factor, the threshold weights being greater than setting as the scene factor is set to 0.1, type of transaction is online money transfer transactions, and weight is set to 0.1, on-line payment business, weight is set to 0.3, user belonging to user terminal is set to 0.2 without previous conviction, has previous conviction to be set to 0, and to arrange weight threshold be 0.3, exceed this threshold value, then allow to perform at line service;

In above-mentioned steps, also can use logistic regression, the weight of each weight factor of user terminal is trained or simulated to neural net, decision tree or maximum entropy scheduling algorithm.

The present embodiment is that all user terminals configure unified weight and are described for server, in a further embodiment, server can be that dissimilar user terminal configures different weights according to predetermined strategy, or is weight corresponding to each user terminal configuration.

401, the first behavioral parameters is sent to server by user terminal 8, concrete user terminal 8 8:00 in evening performs on-line payment business in gymnasium, and the online type of service of current positional information, temporal information and execution is reported server by user terminal 8;

402, server calculates weight according to the weight factor of user terminal 8, the concrete positional information according to user terminal 8 and temporal information determine that its scene factor is 4, and determine that its type of service performed is on-line payment business, this user terminal 8 is without previous conviction, the then factor of synthesise various, calculating its weight is 0.6, is greater than the weight threshold 0.3 of setting, then allow user terminal 8 to perform current at line service, and notify described user terminal 8;

403, after user terminal 8 receives above-mentioned notice, directly on-line payment business is carried out.

In another one embodiment of the present invention, server is the Analysis model of network behaviors that user terminal builds, can be long-term model, mid-term model or short-run model, server can as required or the characteristic of user terminal select, concrete: long-term model needs to retain all scene informations of user terminal; Mid-term, model then needed the scene information retaining (such as three months) user terminal in certain hour, and renewal of rolling, the scene information be about to outside more than three months is deleted in real time; Short-run model then with sky, week, for the cycle, all delete by the scene information exceeded the time limit by user terminal, only retains the scene information in agreement period.

Embodiment five:

With reference to accompanying drawing 5, embodiments provide a kind of information identification equipment 500, comprise receiving element 501, dispensing unit 503 and determining unit 505, wherein

Receiving element 501, for obtaining the first behavioral parameters of user terminal, described first behavioral parameters comprises the positional information of user terminal and temporal information corresponding to described positional information; Receive the second behavioral parameters of described user terminal, described second behavioral parameters comprises described user terminal and performs the current positional information when line service and temporal information corresponding to described positional information;

Dispensing unit 503, the first behavioral parameters for the described user terminal obtained according to described receiving element 501 builds the Analysis model of network behaviors of described user terminal;

Determining unit 505, for the Analysis model of network behaviors according to described user terminal second behavioral parameters and described user terminal, determines whether to allow described user terminal to perform current at line service.

In another one embodiment of the present invention, described dispensing unit 503, also for arranging different scenes for described user terminal, concrete: to be between multiple lane place by the Region dividing residing for described user terminal, a scene of described user terminal will be set between each lane place; Or being between multiple lane place by the Region dividing residing for described user terminal, is a scene of user terminal by the set of time occurred in conjunction with described user terminal between each lane place; Or, be between multiple lane place by the Region dividing residing for described user terminal, a scene of described user terminal will be set between the described user terminal lane place that occurrence number exceedes predetermined threshold in the given time; Or, between the lane place that described user terminal was occurred, was set to a scene of described user terminal.

In another one embodiment of the present invention, the number of times that described dispensing unit 503 occurs in each scene specifically for adding up described user terminal, generate the scene factor corresponding to each scene according to the number of times that described user terminal occurs in each scene, build the mapping relations of described user terminal and the described scene factor.

In another one embodiment of the present invention, described determining unit 505 specifically for determine described user terminal the second behavioral parameters corresponding to the scene factor be greater than the scene factor threshold of described setting time, allow described user terminal to perform current at line service.

In another one embodiment of the present invention, described dispensing unit 503, also for analyzing the behavior of described user terminal, carries out Clustering according to the behavioural analysis result of described user terminal to described user terminal.

In another one embodiment of the present invention, the method for described user terminal being carried out to cluster use comprises expectation maximization algorithm, kmeans, Agglomerative Hierarchical Clustering or dbscan; The measuring similarity used in clustering algorithm comprises Cosin method, Euclidean distance, likeness coefficient or coefficient correlation, carries out the method that initialization uses comprise singular value decomposition method, random selected initial value method or specify initial value method described clustering algorithm.

In another one embodiment of the present invention, described determining unit 505 performs the current group belonging to the user terminal of line service specifically for determining, determines whether to allow described user terminal to perform current at line service according to the safety regulation of described group.

In another one embodiment of the present invention, described determining unit 505 is current at line service specifically for determining whether to allow described user terminal to perform according to the safety regulation of user terminal or Analysis model of network behaviors that are positioned at described group center.

In another one embodiment of the present invention, described dispensing unit 503 is specifically for the first behavior optimum configurations weight for user terminal, and described first behavioral parameters also comprises at least one that perform in the habit of transaction of the transaction record of the Secure Transaction rule of the previous conviction of user described in the type of line service, trading object, transaction network address, user terminal, user terminal, user terminal, user terminal.

In another one embodiment of the present invention, described determining unit 505 is specifically for after being weighted the second behavioral parameters of described user terminal according to the weight of described first behavioral parameters, if the numerical value after weighting exceedes the threshold value of setting, then described user terminal is allowed to perform current at line service.

The identification equipment that the embodiment of the present invention provides can be server, can also be back-stage management or operation system, or other possesses the equipment of above-mentioned functions.

In embodiments of the present invention, described receiving element 501 can be that transceiver module on server is as receiver, reflector, or antenna etc., dispensing unit 503 can be the configuration module on server, realize the setting to some parameter on server, determining unit 505 can be the matching module on server, for the parameter information received and the parameter information prestored being carried out mating or comparing.

It should be noted that, receiving element 501, dispensing unit 503 and determining unit 505 are only names to module identification equipment performing corresponding function, on different identification equipments, may difference to some extent to the name of receiving element 501, dispensing unit 503 and determining unit 505, as long as it possesses the function of receiving element 501 in the embodiment of the present invention, dispensing unit 503 and determining unit 505, receiving element 501, dispensing unit 503 and determining unit 505 all can be regarded as.

Embodiment six

With reference to accompanying drawing 6, embodiments provide a kind of user terminal 600, comprise acquiring unit 602 and antenna 604, wherein:

Acquiring unit 602, for obtaining the first behavioral parameters, described first behavioral parameters comprises the positional information of described user terminal and temporal information corresponding to described positional information; Obtain the second behavioral parameters, described second behavioral parameters comprises described user terminal and performs positional information when line service and temporal information corresponding to described positional information;

Antenna 604, server is sent to for the first behavioral parameters of being obtained by described acquiring unit and the second behavioral parameters, to make described first behavioral parameters for the Analysis model of network behaviors of user terminal described in described server construction, described second behavioral parameters is used for described server, and to determine whether to allow described user terminal to perform according to the Analysis model of network behaviors of described user terminal current at line service.

In another one embodiment of the present invention, described first behavioral parameters also comprises at least one in the habit of transaction of the previous conviction of user described in the type at line service of described user terminal, trading object, transaction network address, user terminal, the Secure Transaction rule of user terminal, the transaction record of user terminal, user terminal.

In another one embodiment of the present invention, described antenna 604 is also for receiving the instruction of described server, and indicate described acquiring unit to obtain the first behavioral parameters and second behavioral parameters of described user terminal according to described instruction, and described first behavioral parameters obtained by described acquiring unit and the second behavioral parameters send to described server.

In another one embodiment of the present invention, described acquiring unit 602 can be module user terminal gathering position information of user's terminal, and described antenna 604 can also be other transceiver etc. on user terminal; It should be noted that, acquiring unit 602 and antenna 604 are only names to module user terminal performing corresponding function, on different user terminals, may difference to some extent to the name of acquiring unit 602 and antenna 604, as long as it possesses the function of acquiring unit 602 and antenna 604 in the embodiment of the present invention, acquiring unit 602 and antenna 604 all can be regarded as.

Embodiment seven

With reference to accompanying drawing 7, the embodiment of the present invention additionally provides a kind of user terminal, described user terminal comprises memory 701 and processor 703, described memory 701 is for storage code, described code comprises: the first behavioral parameters obtaining described user terminal, and described first behavioral parameters comprises the positional information of described user terminal and temporal information corresponding to described positional information; Obtain the second behavioral parameters of described user terminal, described second behavioral parameters comprises described user terminal and performs positional information when line service and temporal information corresponding to described positional information; The first behavioral parameters obtained by described acquiring unit and the second behavioral parameters send to server, to make described server build the Analysis model of network behaviors of described user terminal according to described first behavioral parameters, and it is current at line service to make described server determine whether to allow described user terminal to perform according to the Analysis model of network behaviors of described user terminal and described second behavioral parameters;

Described processor 703 is for performing the code stored in described memory 701.

It should be noted that, user terminal in safety zone identification equipment in embodiment five, embodiment six and seven respectively with embodiment one, two, three, four corresponding, the place of not detailed description in embodiment five, six and seven, can with reference to the description in embodiment one, two, three, four.

Should be appreciated that, in various embodiment of the present invention, in above-mentioned each process sequence number size and do not mean that the priority of execution sequence, the execution sequence of each process should be determined with its function and internal logic, and should not form any restriction to the implementation process of the embodiment of the present invention.

In addition, term " system " and " network " are often used interchangeably in this article herein.Term "and/or" herein, being only a kind of incidence relation describing affiliated partner, can there are three kinds of relations in expression, and such as, A and/or B, can represent: individualism A, exists A and B simultaneously, these three kinds of situations of individualism B.In addition, character "/" herein, general expression forward-backward correlation is to the relation liking a kind of "or".

Those of ordinary skill in the art can recognize, in conjunction with unit and the algorithm steps of each example of embodiment disclosed herein description, can realize with electronic hardware, computer software or the combination of the two, in order to the interchangeability of hardware and software is clearly described, generally describe composition and the step of each example in the above description according to function.Or actually these functions perform with hardware software mode, depend on application-specific and the design constraint of technical scheme.Professional and technical personnel can use distinct methods to realize described function to each specifically should being used for, but this realization should not thought and exceeds scope of the present invention.

Those skilled in the art can have a clear understanding of, and for convenience of description and succinctly, the specific works process of the system of foregoing description, device and unit, with reference to the corresponding process in preceding method embodiment, can not repeat them here.

In several embodiments that the application provides, should be understood that disclosed system, apparatus and method can realize in other way.Such as, device embodiment described above is only schematic, the such as division of described unit, only that a kind of logic function divides, actual can have other dividing mode when realizing, such as multiple unit or assembly can in conjunction with or a system can be inherited, or some features can be ignored, or do not perform.In addition, shown or discussed coupling each other or direct-coupling or communication connection can be indirect coupling by some interfaces, device or unit or communication connection, also can be electric, machinery or other form connect.

The described unit illustrated as separating component can or can not be physically separate, and the parts as unit display can be or may not be physical location, namely can be positioned at a place, or also can be distributed in multiple network element.Some or all of unit wherein can be selected according to the actual needs to realize the object of embodiment of the present invention scheme.

In addition, each functional unit in each embodiment of the present invention can be integrated in a processing unit, and also can be that the independent physics of unit exists, also can be that two or more unit are integrated in a unit.Namely above-mentioned integrated unit can adopt the form of hardware to realize, and the form of SFU software functional unit also can be adopted to realize.

Through the above description of the embodiments, those skilled in the art can be well understood to the present invention can use hardware implementing, or software simulating, or their compound mode realizes.When implemented in software, can see that above-mentioned functions is stored in computer-readable medium or as the one or more instruction on computer-readable medium or code to transmit.Computer-readable medium comprises computer-readable storage medium and communication media, and wherein communication media comprises any medium being convenient to transmit computer program from a place to another place.Storage medium can be any medium that computer can access.Be not limited to as example: computer-readable medium can comprise RAM, ROM, EEPROM, CD-ROM or other optical disc storage, magnetic disk media or other magnetic storage apparatus or can be used in carrying or storing the expectation with instruction or data structure form program code and can by any other medium of computer access.In addition, any connection can be suitable become computer-readable medium, such as, if software be use coaxial cable, optical fiber cable, twisted-pair feeder, the wireless technology of Digital Subscriber Line (SDL) or such as infrared ray, radio and microwave and so on is included in affiliated medium fixing in.Dish as used in the present invention (Disk) and dish (Disc) comprise compression laser disc (CD), laser dish, laser disc, Digital Versatile Disc (DVD), floppy disk and Blu-ray Disc, the copy data of the usual magnetic of its mid-game, dish then carrys out the copy data of optics with laser.Combination above also should be included within the protection range of computer-readable medium.

In a word, the foregoing is only the preferred embodiment of technical solution of the present invention, be not intended to limit the protection range of Ben Fanming.Within the spirit and principles in the present invention all, any amendment done, equivalent replacement, improvement etc., all should be included within protection scope of the present invention.

Claims

1. an information identifying method, is characterized in that, comprising:

Obtain the first behavioral parameters of user terminal, described first behavioral parameters comprises the positional information of described user terminal and temporal information corresponding to described positional information, builds the Analysis model of network behaviors of described user terminal according to the first behavioral parameters of described user terminal;

2. information identifying method according to claim 1, is characterized in that, described the first behavioral parameters according to user terminal also comprises before building the Analysis model of network behaviors of described user terminal:

For described user terminal arranges different scenes, concrete:

3. information identifying method according to claim 2, is characterized in that, the Analysis model of network behaviors that described the first behavioral parameters according to user terminal builds described user terminal comprises:

4. information identifying method according to claim 3, is characterized in that, the described Analysis model of network behaviors according to described user terminal second behavioral parameters and described user terminal, determines whether to allow described user terminal to perform current at line service, comprising:

5. information identifying method according to claim 3, is characterized in that, also comprises:

6. information identifying method according to claim 5, is characterized in that, the method for described user terminal being carried out to cluster use comprises expectation maximization algorithm, kmeans, Agglomerative Hierarchical Clustering or dbscan; The measuring similarity used in clustering algorithm comprises Cosin method, Euclidean distance, likeness coefficient or coefficient correlation, carries out the method that initialization uses comprise singular value decomposition method, random selected initial value method or specify initial value method described clustering algorithm.

7. the information identifying method according to claim 5 or 6, is characterized in that, the described Analysis model of network behaviors according to described user terminal second behavioral parameters and described user terminal, determines whether to allow described user terminal to perform current at line service, comprising:

Determine to perform current group belonging to the user terminal of line service;

8. information identifying method according to claim 7, is characterized in that, determines whether to allow described user terminal to perform current at line service, comprising according to the safety regulation of described group:

9. information identifying method according to claim 3, is characterized in that, also comprises:

10. information identifying method according to claim 9, is characterized in that, the described Analysis model of network behaviors according to described user terminal second behavioral parameters and described user terminal, determines whether to allow described user terminal to perform current at line service, comprising:

11. 1 kinds of information identification equipments, is characterized in that, comprising:

12. information identification equipments according to claim 11, is characterized in that,

Described dispensing unit, also for arranging different scenes for described user terminal, concrete:

13. information identification equipments according to claim 12, it is characterized in that, the number of times that described dispensing unit occurs in each scene specifically for adding up described user terminal, generate the scene factor corresponding to each scene according to the number of times that described user terminal occurs in each scene, build the mapping relations of described user terminal and the described scene factor.

14. information identification equipments according to claim 13, it is characterized in that, described determining unit specifically for determine described user terminal the second behavioral parameters corresponding to the scene factor be greater than the scene factor threshold of described setting time, allow described user terminal to perform current at line service.

15. information identification equipments according to claim 13, is characterized in that:

Described dispensing unit, also for analyzing the behavior of described user terminal, carries out Clustering according to the behavioural analysis result of described user terminal to described user terminal.

16. information identification equipments according to claim 15, is characterized in that, the method for described user terminal being carried out to cluster use comprises expectation maximization algorithm, kmeans, Agglomerative Hierarchical Clustering or dbscan; The measuring similarity used in clustering algorithm comprises Cosin method, Euclidean distance, likeness coefficient or coefficient correlation, carries out the method that initialization uses comprise singular value decomposition method, random selected initial value method or specify initial value method described clustering algorithm.

17. information identification equipments according to claim 15 or 16, it is characterized in that, described determining unit performs the current group belonging to the user terminal of line service specifically for determining, determines whether to allow described user terminal to perform current at line service according to the safety regulation of described group.

18. information identification equipments according to claim 17, it is characterized in that, described determining unit is current at line service specifically for determining whether to allow described user terminal to perform according to the safety regulation of user terminal or Analysis model of network behaviors that are positioned at described group center.

19. information identification equipments according to claim 13, it is characterized in that, described dispensing unit is specifically for the first behavior optimum configurations weight for user terminal, and described first behavioral parameters also comprises at least one that perform in the habit of transaction of the transaction record of the Secure Transaction rule of the previous conviction of user described in the type of line service, trading object, transaction network address, user terminal, user terminal, user terminal, user terminal.

20. information identification equipments according to claim 19, it is characterized in that, described determining unit is specifically for after being weighted the second behavioral parameters of described user terminal according to the weight of described first behavioral parameters, if the numerical value after weighting exceedes the threshold value of setting, then described user terminal is allowed to perform current at line service.

21. 1 kinds of user terminals, is characterized in that, comprising:

Acquiring unit, for obtaining the first behavioral parameters, described first behavioral parameters comprises the positional information of described user terminal and temporal information corresponding to described positional information; Obtain the second behavioral parameters of described user terminal, described second behavioral parameters comprises described user terminal and performs positional information when line service and temporal information corresponding to described positional information;

22. user terminals according to claim 21, it is characterized in that, described first behavioral parameters also comprises at least one in the habit of transaction of the previous conviction of user described in the type at line service of described user terminal, trading object, transaction network address, user terminal, the Secure Transaction rule of user terminal, the transaction record of user terminal, user terminal.

23. user terminals according to claim 21 or 22, it is characterized in that, described antenna is also for receiving the instruction of described server, and indicate described acquiring unit to obtain the first behavioral parameters and second behavioral parameters of described user terminal according to described instruction, and described first behavioral parameters obtained by described acquiring unit and the second behavioral parameters send to described server.